Summary
- Environment: Event-reservation system
- Operational impact: Temporary service suspension during security response
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 14, 2026; updated as evidence emerges.
What happened
Impact
The notice provisionally identifies 5,923 people with potentially exposed applicant contacts, birth dates, gender, customer identifiers, companion details and event/stay information. It did not confirm leakage of passwords or card data. [1]
Timeline
First reported reservation-system access
First reported reservation-system access.
[1]Further access period begins
Further access period begins.
[1]Reservation-data leakage identified
Reservation-data leakage identified.
[1]Incident and response disclosed
Incident and response disclosed.
[1]Briefing updated
This briefing was last reviewed and updated on November 14, 2026.
Threat Group & Attack Vector
Snow Peak attributed this intrusion to a vulnerability but did not identify a CVE or specific exploit. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific ATT&CK technique is mapped from the available evidence.
Response
Snow Peak temporarily suspended the affected services and strengthened security and monitoring. Its November 13 notice planned a store restart that day, with other services awaiting security measures. It had not confirmed secondary harm. [1]